Skip to content
Fencer Vulns
medium 5.5

CVE-2021-3502 json

A flaw was found in avahi 0.8-5.

published 2021-05-07 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-26822

cvss
5.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 31%
public exploits
0
none known

Summary

A flaw was found in avahi 0.8-5. A reachable assertion is present in avahi_s_host_name_resolver_start function allowing a local attacker to crash the avahi service by requesting hostname resolutions through the avahi socket or dbus methods for invalid hostnames. The highest threat from this vulnerability is to the service availability.

Patch / fix

  • avahi Debian 14, Debian 13, Debian 12 0.8-6

debian advisories DEBIAN-CVE-2021-3502

  • avahi Ubuntu 22.04 LTS 0.8-5ubuntu4

ubuntu advisories UBUNTU-CVE-2021-3502

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • avahi RHEL 9 0.8-15.el9
  • avahi-glib RHEL 9 0.8-15.el9
  • avahi-libs RHEL 9 0.8-15.el9
  • avahi-tools RHEL 9 0.8-15.el9
  • avahi-compat-howl RHEL 9 0.8-15.el9
  • avahi-compat-libdns_sd RHEL 9 0.8-15.el9

red hat advisories RHSA-2023:6707

  • avahi openSUSE Tumbleweed 0.8-7.2

opensuse advisories openSUSE-SU-2024:10643-1

  • avahi AlmaLinux 9 0.8-15.el9
  • avahi-glib AlmaLinux 9 0.8-15.el9
  • avahi-libs AlmaLinux 9 0.8-15.el9
  • avahi-tools AlmaLinux 9 0.8-15.el9
  • avahi-compat-howl AlmaLinux 9 0.8-15.el9
  • avahi-compat-libdns_sd AlmaLinux 9 0.8-15.el9

almalinux advisories ALSA-2023:6707

  • avahi Alpine 3.24, Alpine 3.23, Alpine 3.22 +4 more 0.8-r5

alpine advisories ALPINE-CVE-2021-3502

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • avahi Azure Linux 3.0 0.8-1

azure linux advisories AZL-40943

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • avahi Arch Linux 0.8+22+gfd482a7-1

arch linux advisories AVG-2341

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-3502 updated cvss 5.5

avahi: reachable assertion in avahi_s_host_name_resolver_start when trying to resolve badly-formatted hostnames

  • Red Hat CodeReady Linux Builder (v. 9) avahi-compat-howl 0.8-15.el9, avahi-compat-libdns_sd 0.8-15.el9 Red Hat Enterprise Linux AppStream (v. 9) avahi-glib 0.8-15.el9, avahi-tools 0.8-15.el9 Red Hat Enterprise Linux BaseOS (v. 9) avahi 0.8-15.el9, avahi-libs 0.8-15.el9
    fixed: vendor fix RHSA-2023:6707
  • Red Hat Enterprise Linux 6 avahi, avahi-ui, avahi-qt3, avahi-qt4, avahi-glib, avahi-libs, +7 more Red Hat Enterprise Linux 7 avahi, avahi-ui, avahi-qt3, avahi-qt4, avahi-glib, avahi-libs, +8 more Red Hat Enterprise Linux 8 avahi, avahi-ui, avahi-glib, avahi-libs, avahi-tools, avahi-autoipd, +5 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 31% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • bugzilla.redhat.com https://bugzilla.redhat.com/show_bug.cgi?id=1946914 referenced PoC, tagged "exploit" by a source, unverified
  • github.com https://github.com/lathiat/avahi/issues/338 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P

Affected products

  • n/a avahi

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.